Support for [read/edit/direct/append/comment modes: ] was added recently, but this only affects what is displayed. This should be extended to access permissions for modes, and generate a 403 error if violated.